[cacl] Expect the per-feature docker0 syslog ACCEPT for both bridged features - #28006
Open
shreyansh-nexthop wants to merge 1 commit into
Open
shreyansh-nexthop wants to merge 1 commit into
shreyansh-nexthop wants to merge 1 commit into
Conversation
…features caclmgrd owns a docker0 RELP (tcp/2514) INPUT ACCEPT per bridge-networked feature and installs it while that feature is enabled, but the expected-rule generator only knew the dhcp_server instance. On a device with the redfish feature enabled, caclmgrd's redfish_syslog rule is reported as unexpected and test_cacl_application_nondualtor fails. Generate the expectation for both bridged features from the same condition caclmgrd keys on, the FEATURE state, so the test is correct in either feature state: rule expected while enabled, not expected while disabled. Signed-off-by: Shreyansh Jain <shreyansh@nexthop.ai>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
|
/azp run |
github-actions
Bot
requested review from
ZhaohuiS,
matthew-soulsby and
xwjiang-ms
September 18, 2026 10:52
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
shreyansh-nexthop
marked this pull request as ready for review
September 18, 2026 10:55
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
nh-grecs Bot
pushed a commit
to nexthop-ai/sonic-mgmt
that referenced
this pull request
Sep 19, 2026
…features rebuild-source: sonic-net#28006 @ nexthop-ai/sonic-mgmt 8905a3b [case: upstream:open]
nh-grecs Bot
pushed a commit
to nexthop-ai/sonic-mgmt
that referenced
this pull request
Sep 19, 2026
…features rebuild-source: sonic-net/pull/28006 @ nexthop-ai/sonic-mgmt 8905a3b [case: upstream:open]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of PR
Summary:
Fixes #28005
sonic-net/sonic-host-services#429 made caclmgrd own a docker0 RELP (tcp/2514) INPUT ACCEPT for the redfish container's syslog forwarding, installed while the redfish FEATURE state is enabled. It is the companion of sonic-net/sonic-buildimage#29258, which points bridge-networked containers' rsyslog at the docker0 gateway. generate_expected_rules only knows the dhcp_server instance of this rule (#26477), so test_cacl_application_nondualtor reports the caclmgrd-owned redfish_syslog rule as unexpected and fails on any device where the feature is enabled at run time.
Type of change
Back port request
Tested branch
Test result
Approach
What is the motivation for this PR?
Restore test_cacl_application_nondualtor on devices where the redfish feature is enabled. The caclmgrd-owned redfish_syslog docker0 exception is correct behaviour, and the test's expected-rule list does not include it, so the test fails on a healthy device.
How did you do it?
Loop the feature-gated dhcp_server syslog expectation from #26477 over both bridged features, keeping the FEATURE-state gate caclmgrd itself keys on, so the expectation is present exactly while the rule is.
How did you verify/test it?
Any platform specific information?
The redfish feature exists only on images built with INCLUDE_REDFISH=y; on all other devices the feature lookup adds no expectation, so behaviour is unchanged.
Supported testbed topology if it's a new test case?
N/A
Documentation
N/A